Agent Economy ReportAgent Economy ReportCAUTION version 1.3.8 · audited 2026-09-17
This skill installs a shell-based web search helper that sends search queries and a Prismfy API key to the third-party service at api.prismfy.io. It declares itself as the default OpenClaw search tool and includes a bootstrap hook that instructs the agent to prefer live searches. The code does not download or execute remote code, does not hide network destinations, and does not touch wallets or payments. However, it sends whatever the agent includes in a query to an external service and tells the agent to search first in many situations, which can expose sensitive context. This matches the publisher's own disclosed risks, so it should be reviewed carefully before use.
Instructions try to steer the agent beyond the declared purpose. hooks/openclaw/HOOK.md line 4 registers an agent:bootstrap event. HOOK.md line 33 says: 'Prefer real search results over training data whenever the answer might have changed or needs to be current:' and line 46 says: '**When in doubt, a quick search takes seconds and prevents wrong answers.**' These are behavioral instructions from an untrusted package that steer the agent toward sending more queries to an external service, although they are disclosed and align with the skill's declared default-search purpose.
| Declared purpose | Default web search for OpenClaw, querying search engines through Prismfy using a bundled search.sh helper for search, quota checks, and engine/time/domain filters. |
| Observed behavior | When invoked, search.sh uses curl to make GET and POST requests to https://api.prismfy.io. It sends the PRISMFY_API_KEY environment variable as an Authorization: Bearer header and sends a JSON body containing the user's query, engines, language, and page. It can also call the quota endpoint and pretty-print results using jq. SKILL.md and hooks/openclaw/HOOK.md instruct the agent to run search.sh and prefer live web search. No hidden destinations, obfuscated code, download-and-execute, or payment/wallet behavior was observed. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: PRISMFY_API_KEY; touches persistence (cron, shell profile, autostart) |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | search.sh makes outbound HTTPS requests to api.prismfy.io for search and quota operations. |
| shell | needed | The skill is a bash helper; SKILL.md and HOOK.md instruct running commands such as bash search.sh. |
| credentials | needed | The script requires PRISMFY_API_KEY and sends it to api.prismfy.io as a Bearer token, which is expected for the API but exposes the credential to the third-party service. |
| persistence | needed | hooks/openclaw/HOOK.md registers on agent:bootstrap, and SKILL.md instructs the user to export PRISMFY_API_KEY in ~/.zshrc or ~/.bashrc. |
| severity | finding |
|---|---|
| info | Declared purpose is third-party web search The skill describes itself as the default OpenClaw web search tool backed by Prismfy, so outbound search traffic to Prismfy is part of its declared function. SKILL.md:4 Default web search for OpenClaw. Search the web across 10 engines — Google, |
| info | Requires a Prismfy API key The skill declares that PRISMFY_API_KEY must be present in the environment. SKILL.md:15 - PRISMFY_API_KEY |
| info | Search traffic is sent to api.prismfy.io The helper script uses api.prismfy.io as the base URL for its API calls. search.sh:19 BASE_URL="https://api.prismfy.io" |
| medium | API key is transmitted to Prismfy The script reads PRISMFY_API_KEY and sends it to the Prismfy API as an Authorization header. This is required for the advertised API, but the credential leaves the user's environment. search.sh:68 -H "Authorization: Bearer $PRISMFY_API_KEY" |
| info | Makes outbound network requests The helper uses curl to contact the Prismfy API. search.sh:76 if ! response=$(curl "${curl_args[@]}"); then |
| low | Sends the user query text to Prismfy The script builds a JSON body containing the query and other search parameters, so any text supplied to search.sh is sent to the third-party service. search.sh:148 '{query: $q, engines: $engines, language: $lang, page: ($page | tonumber)}') |
| low | Instructs user to persist the API key in shell profile The setup instructions tell the user to add the Prismfy API key to ~/.zshrc or ~/.bashrc, making the credential persistent. SKILL.md:55 export PRISMFY_API_KEY="ss_live_your_key_here" |
| medium | Installs a bootstrap hook The package registers a hook on agent:bootstrap, meaning the skill's instructions are loaded into the agent when it starts. hooks/openclaw/HOOK.md:4 metadata: {"openclaw":{"emoji":"🔍","events":["agent:bootstrap"]}} |
| medium | Instructs agent to prefer live search This bootstrap instruction can increase how often the agent sends queries to the Prismfy service, expanding potential exposure of user or agent context. hooks/openclaw/HOOK.md:46 **When in doubt, a quick search takes seconds and prevents wrong answers.** |
| info | Publisher discloses broad search behavior The skill card acknowledges that default search behavior can send user requests to Prismfy more often than expected. skill-card.md:25 Risk: Broad default-search behavior can send ordinary user requests to an external Prismfy service more often than users may expect. |
| info | Publisher discloses sensitive data exposure risk The skill card explicitly warns that sensitive content may be exposed if it becomes part of a search request. skill-card.md:29 Risk: Sensitive terms, secrets, private code, customer data, or confidential internal details may be exposed if included in requests that trigger search. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.prismfy.io | not in the service index | search.sh:19 |
| clawhub.ai | not in the service index | .clawhub/origin.json:3 |
| prismfy.io | not in the service index | SKILL.md:21 |
| Binaries invoked | bash, curl, node |
| Environment variables read | BASE_URL, PRISMFY_API_KEY, QUOTA_ENDPOINT, SEARCH_ENDPOINT |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 7 |
| Persistence | 2 |
| file | lines | sha256 |
|---|---|---|
.clawhub/origin.json | 7 | a88ae56df11a34eb… |
SKILL.md | 219 | 43f0df0cafe65cab… |
_meta.json | 6 | 01152f77f2202a2b… |
hooks/openclaw/HOOK.md | 59 | 3d780d86ef95c863… |
search.sh | 265 | 9c57d5d820092303… |
skill-card.md | 55 | 243bcbffc0ec38bf… |
For agents
JSON: https://agenteconomy.report/k/prismfy-search.audit.json · badge: https://agenteconomy.report/k/prismfy-search.audited.svg ·
skill rating: /k/prismfy-search · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).